Moderate: python38:3.8 and python38-devel:3.8 security update
Summary
ALSA-2023:2763: Moderate: python38:3.8 and python38-devel:3.8 security update. Affects python38 versions < 3.8.16-1.module_el8.8.0+3482+d5d93a3e. Fixed in 3.8.16-1.module_el8.8.0+3482+d5d93a3e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Vulnerability Detail
The vulnerability affects the python38 and python38-devel packages in AlmaLinux 8. It includes the following security issues:
- CVE-2020-10735: The int() type in PyLong_FromString() does not limit the amount of digits converting text to int, leading to a denial of service (DoS) attack.
- CVE-2021-28861: An open redirection vulnerability in lib/http/server.py may lead to information disclosure.
- CVE-2022-45061: A CPU denial of service can occur due to an inefficient IDNA decoder.
How To Fix
Minimum fixed version
3.8.16-1.module_el8.8.0+3482+d5d93a3e
This is the first release that contains the fix.
sudo dnf update python38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python38 and python38-devel packages in AlmaLinux 8 are affected by multiple security vulnerabilities. It is recommended to upgrade these packages to the fixed versions to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python38 →
FAQ
The impact of CVE-2020-10735 is a denial of service (DoS) attack, which can lead to the unavailability of the affected Python application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade the affected packages to the fixed versions.
Yes, you can refer to the CVE pages listed in the References section of the vulnerability details for more detailed information about each vulnerability.
You can find the AlmaLinux Release Notes for this update by following the link provided in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for python38.
